CVE-2012-0884: Medium severity openssl vulnerability

Q: What is the severity of CVE-2012-0884?

CVE-2012-0884 has a Medium severity rating due to its potential for causing data decryption vulnerabilities.

Q: How do I fix CVE-2012-0884?

To fix CVE-2012-0884, upgrade your OpenSSL to version 0.9.8u or later, or 1.0.0h or newer.

Q: Who is affected by CVE-2012-0884?

CVE-2012-0884 affects all versions of OpenSSL prior to 0.9.8u and 1.0.0h.

Q: What kind of attack is possible with CVE-2012-0884?

CVE-2012-0884 allows attackers to perform a Million Message Attack (MMA) to decrypt data.

Q: Is CVE-2012-0884 a common vulnerability?

Yes, CVE-2012-0884 is considered a notable vulnerability within cryptographic implementations.

Published Mar 13, 2012

Updated

The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack.

Affected Software

66 affected components

OpenSSL OpenSSL<=0.9.8t

OpenSSL OpenSSL=0.9.0b

OpenSSL OpenSSL=0.9.1b

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.3

OpenSSL OpenSSL=0.9.3a

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7f

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL=0.9.7h

OpenSSL OpenSSL=0.9.7i

OpenSSL OpenSSL=0.9.7j

OpenSSL OpenSSL=0.9.7k

OpenSSL OpenSSL=0.9.7l

OpenSSL OpenSSL=0.9.7m

OpenSSL OpenSSL=0.9.8

OpenSSL OpenSSL=0.9.8a

OpenSSL OpenSSL=0.9.8b

OpenSSL OpenSSL=0.9.8c

OpenSSL OpenSSL=0.9.8d

OpenSSL OpenSSL=0.9.8e

OpenSSL OpenSSL=0.9.8f

OpenSSL OpenSSL=0.9.8g

OpenSSL OpenSSL=0.9.8h

OpenSSL OpenSSL=0.9.8i

OpenSSL OpenSSL=0.9.8j

OpenSSL OpenSSL=0.9.8k

OpenSSL OpenSSL=0.9.8l

OpenSSL OpenSSL=0.9.8m

OpenSSL OpenSSL=0.9.8n

OpenSSL OpenSSL=0.9.8o

OpenSSL OpenSSL=0.9.8p

OpenSSL OpenSSL=0.9.8q

OpenSSL OpenSSL=0.9.8r

OpenSSL OpenSSL=0.9.8s

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0d

OpenSSL OpenSSL=1.0.0e

OpenSSL OpenSSL=1.0.0f

OpenSSL OpenSSL=1.0.0g

Event History

Mar 13, 2012

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0884?

CVE-2012-0884 has a Medium severity rating due to its potential for causing data decryption vulnerabilities.

How do I fix CVE-2012-0884?

To fix CVE-2012-0884, upgrade your OpenSSL to version 0.9.8u or later, or 1.0.0h or newer.

Who is affected by CVE-2012-0884?